{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3azstd-jni_projectzstd-jni/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zstd-jni_project:zstd-jni:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-87824"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["zstd-jni (\u003c 1.5.7-14)","zstd-jni (1.5.5-6 to 1.5.7-13)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe zstd-jni library, a Java wrapper for the Zstandard compression algorithm, contains a critical vulnerability in the Zstd.trainFromBufferDirect method. Versions prior to 1.5.7-14 fail to properly validate the capacity of the samples buffer when processing compression dictionary training data. By providing crafted per-sample length arrays, an attacker can force the native Zstandard implementation to access memory addresses beyond the allocated buffer boundaries. This out-of-bounds memory read causes a segmentation fault within the native library, which subsequently results in the abrupt termination of the Java Virtual Machine (JVM). This vulnerability poses a significant denial-of-service risk to any Java application that utilizes zstd-jni to process untrusted compression dictionary training data.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in a high-severity denial-of-service condition due to the crash of the host JVM. Applications that accept user-provided training samples for Zstandard dictionary building are at risk of repeated service interruption or potential instability if the native memory corruption leads to unpredictable process states before the final crash occurs.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the zstd-jni dependency to version 1.5.7-14 or later to remediate CVE-2026-87824.\u003c/li\u003e\n\u003cli\u003eAudit all application entry points that pass user-supplied input to Zstd.trainFromBufferDirect to ensure that input length arrays are validated against expected bounds before processing.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for sudden JVM process exits accompanied by native crash dumps (hs_err_pid files) that indicate errors within the libzstd-jni native library.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-10T19:08:07Z","date_published":"2026-09-09T16:58:46Z","id":"https://feed.craftedsignal.io/briefs/2026-09-zstd-jni-oob-read/","summary":"The zstd-jni library fails to validate sample buffer capacity in the Zstd.trainFromBufferDirect method, allowing attackers to trigger out-of-bounds memory access and JVM termination via crafted inputs.","title":"Out-of-Bounds Memory Access in zstd-jni","url":"https://feed.craftedsignal.io/briefs/2026-09-zstd-jni-oob-read/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:zstd-Jni_project:zstd-Jni:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}